Compliance Update. Doug Johnson ATC Customer Meeting May 24, Helping to keep the lights on, businesses running and communities strong

Transcription

1 Compliance Update Doug Johnson ATC Customer Meeting May 24, 2011 Helping to keep the lights on, businesses running and communities strong

2 Discussion Topics Compliance Overview ATC s Compliance Audit & CIP Spot Check NERC Event Analysis Process FERC Standards of Conduct 2

3 Compliance Overview NERC Reliability Standards became mandatory in June 2007 ATC is registered as: Transmission Owner Transmission Operator Planning Authority Transmission Planner Some 75 Reliability Standards which include 1000 requirements are applicable to ATC ATC has regulatory oversight from two NERC Regional Entities - Midwest Reliability Organization and ReliabilityFirst Corporation 3

4 Compliance Overview The NERC Reliability Standards impose requirements on essentially all aspects of ATC s business operations, including: Normal operations Emergency operations Transmission planning, modeling, and design Training Physical security Cyber security Equipment maintenance & testing Vegetation management Communications Coordination with interconnected companies 4

5 Compliance Overview The NERC Regional Entities administer a formal Compliance Monitoring and Enforcement Program which include monitoring and enforcement processes: Audits Self-certifications Spot Checks Compliance Violation Investigations Self-reporting Periodic Data Submittals 5

6 Compliance Audit & CIP Spot Check Dual Region Review MRO lead with RFC participation Compliance Audit October 11-13, MRO auditors 1 RFC auditor CIP Spot Check October 11 21, MRO auditors 1 RFC auditors 3 FERC observers 1 NERC observers 6

7 Compliance Audit 36 NERC Reliability Standards 3 RFC Regional Standards CIP Spot Check CIP-002 thru CIP requirements Scope of Audit & CIP Spot Check 7

8 ATC Preparations for Audit Preparations started 1 year in advance Internal Challenge meetings Independent / 3 rd party mock audits Pre-audit meetings with MRO team leads Internal / external legal counsel Subject Matter Expert coaching Reliability Standards Audit Worksheets (RSAWs) & supporting evidentiary documentation submitted to MRO ~30 days in advance of on-site audits 8

9 Focus Areas-Compliance Audit Compliance Audit Onsite interviews required for less than 15 of the 36 in-scope Reliability Standards PRC-005 Equipment Maintenance & Testing Vegetation Management Facility Ratings Communications / Interface between ATC and the RC, BAs, and LBAs Operator Training 9

10 Focus Areas CIP Spot Check Discuss scope of Cyber Security Policy Explain CIP-002 risked-based methodology CIP-004 personnel records Demonstrate PSP six-wall Explain / defend the classification of your Cyber Assets Adequacy of Vulnerability Assessments Execution of Incident Response Plan Demonstrate Change Management 10

11 Audit & CIP Spot Check Results No violations from the NERC Operational Compliance Audit Minor potential violations from the CIP Spot Check ATC is finalizing mitigation plans and anticipates negotiation settlements with Midwest Reliability Organization 11

12 NERC Event Analysis Process Newly issued NERC Event Analysis Process Establishes process and requirements for responding to disturbance events: Event notification Event reporting Lessons learned Compliance evaluation Event Analysis coordination Most system disturbance events will require our companies to work collaboratively to analyze and identify lessonslearned 12

13 FERC Standards of Conduct FERC Standards of Conduct prohibits ATC from sharing non-public transmission function information with marketing function employees of ATC s affiliated/interconnected companies ATC s affiliated/interconnected companies are prohibited from acting as a conduit for non-public transmission function information Standards of Conduct Agreements (SOCAs) between ATC and affiliated/interconnected companies define obligations 13

14 Questions? 14